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ABSTRACT 

In this paper, a bank of Kalman filters is applied to aircraft gas 
turbine engine sensor and actuator fault detection and isolation (FDI) 
in conjunction with the detection of component faults. This approach 
uses multiple Kalman filters, each of which is designed for detecting a 
specific sensor or actuator fault. In the event that a fault does occur, 
all filters except the one using the correct hypothesis will produce 
large estimation errors, thereby isolating the specific fault. In the 
meantime, a set of parameters that indicate engine component 
performance is estimated for the detection of abrupt degradation. The 
proposed FDI approach is applied to a nonlinear engine simulation at 
nominal and aged conditions, and the evaluation results for various 
engine faults at cruise operating conditions are given. The ability of 
the proposed approach to reliably detect and isolate sensor and 
actuator faults is demonstrated. 


NOMENCLATURE 


A16 

Variable bypass duct area 

A8 

Nozzle area 

BST 

Booster 

CLM 

Component Level Model 

FAN 

Fan 

FDI 

Fault detection and isolation 

FOD 

Foreign object damage 

HPC 

High-pressure compressor 

HPT 

High-pressure turbine 

LPT 

Low-pressure turbine 

P27 

HPC inlet pressure 

PS15 

Bypass duct static pressure 

PS3 

Combustor inlet static pressure 

PS56 

LPT exit static pressure 

T27D 

Booster inlet temperature 

T56 

LPT exit temperature 


TMPC 

Burner exit heat soak 

WF36 

Fuel flow 

XN2 

Low-pressure spool speed, measured 

XN25 

High-pressure spool speed, measured 

XNH 

High-pressure spool speed, state variable 

XNL 

Low-pressure spool speed, state variable 


INTRODUCTION 

Fault detection and isolation (FDI) logic plays a critical role in 
enhancing the safety and reliability and reducing the operating cost of 
aircraft propulsion systems. However, achieving the FDI task with 
high reliability is a challenging problem. Faults may occur in various 
degrees of severity at various locations; therefore numerous fault 
scenarios are possible. Moreover, the engine’s complex structure and 
harsh operating environment make interpretation of the available 
information difficult. To deal with such problems, the introduction of 
analytical redundancy has become common and is considered more 
cost-effective than hardware redundancy. With the increase of digital 
computational power, more sophisticated approaches such as the 
utilization of an on-board engine model have become possible. 

When a fault occurs, the first step is to detect it as soon as possible 
so that the scenario of a minor fault escalating to a more serious failure 
can be avoided. The approach commonly used for model-based fault 
detection is composed of two steps: 1) generate residual signals from 
the sensor measurements and their estimated values, and then 2) 
compare the residuals with thresholds to make fault detection 
decisions [1]. Sensor noise and modeling uncertainty are key factors 
that affect detection performance. A fault signature contained in the 
measurements is often corrupted by sensor noise, and un-modeled 
engine dynamics may generate a fault-like signature. These factors 
lead to missed detections and false alarms. To reduce the effects of 
noise, the sensor measurements can be averaged over a given length of 
time. Although this approach may remove spike-like fault signatures, 
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it can retain fault information which spans a period of time. To deal 
with modeling uncertainty, robust detection approaches have been 
investigated by some researchers [2,3]. In the robust design approach, 
modeling uncertainty is accounted for in the residual generation 
process. Therefore, fault detection logic can be sensitive to faults 
while being robust to modeling uncertainty. 

Once a fault is successfully detected, the next step is to isolate the 
particular fault from other potential faults. A single fault isolation 
technique for aircraft engine performance diagnostics was investigated 
by Volponi et al. [4]. Assuming that a fault has already been detected, 
this approach processed Kalman filter equations iteratively for each of 
the root causes under consideration and subsequently ranked fault 
candidates in order of likelihood based on the estimation error norms. 
The application of a bank of estimators for fault detection and isolation 
was conducted by Merrill et al. [5], Duyar et al. [6], and Menke et al. 
[7]. This approach uses multiple estimators, each of which is designed 
for detecting a specific fault. Since each estimator is designed based 
on a specific hypothesis (such as the failure of a single sensor or 
actuator), all the estimators except the one using the correct hypothesis 
will produce large estimation errors when a fault occurs. By 
monitoring the residual of each estimator, the specific fault that has 
occurred can be detected and isolated. 

The use of a bank of Kalman filters for addressing aircraft engine 
sensor failures was investigated by NASA’s Advanced Detection, 
Isolation, and Accommodation (ADIA) Program during the 1980’s [5]. 
This program successfully demonstrated improved control loop 
tolerance to sensor failures (bias and drift) using the aforementioned 
analytical technique. It did not, however, address robustness issues in 
the presence of engine degradation or other faults. Over their lifetime 
of operation, engine components will undergo some amount of 
degradation. This degradation may be gradual or abrupt as in the case 
of foreign object damage. If abrupt component degradation has 
occurred, a sensor FDI system may generate a false alarm. Similarly, 
an actuator failure may cause a false alarm or missed detection if not 
considered. In the new framework, actuator and component faults are 
accounted for to expand the FDI capability. 

The proposed FDI approach is applied to a nonlinear engine 
simulation and evaluated for various engine faults at cruise operating 
conditions. In order to mimic the real engine environment, the 
nonlinear simulation is executed not only at the nominal, or healthy, 
condition but also at an aged condition. Although the effectiveness of 
the FDI system is impacted by aging engine effects, a simple approach 
to recover the performance is discussed and evaluated. 


DEVELOPMENT OF FAULT DETECTION AND ISOLATION 
LOGIC 

A depiction of the FDI logic integrated with the propulsion system 
is shown in Fig. 1. The FDI logic uses two sets of input signals: 
sensor measurements and control commands. Sensor measurements 
are corrupted by noise and may be faulty due to sensor failure. 
Actuators may also experience mechanical and/or electrical failures. 
As shown in Fig. 1, the FDI logic uses control commands ( u cmd ). 
Alternatively, the true actuator positions (w^ Me ) may be directly 
measured, and the sensed values may be used by the FDI logic. 
However, using sensed actuator positions would add complexity to the 
FDI problem, since an actuator fault can happen not only to an 
actuator itself but also to an actuator position feedback sensor. 
Therefore, an actuator fault is simply defined as an inconsistency 
between true actuator position and control command. The sensor and 
actuator failures dealt with in this paper are so-called “soft” failures. 
Soft failures are defined as inconsistencies between true and measured 


Component 

Actuator Fault Fault Sensor Fault 



In-flight FDI 

• Sensor/actuator fault detection and isolation 

• Detection of abrupt component degradation 


Figure 1. Propulsion System with Fault Detection 
and Isolation Logic 


sensor values (or true and commanded actuator values) that are 
relatively small in magnitude and thus difficult to detect by a simple 
range-checking approach, whereas “hard” failures are larger in 
magnitude and thus more readily detectable. Soft failures can take 
different forms such as a fixed scalar, a fixed bias, a drift, or 
intermittent spikes. Among these failures, fixed bias is investigated in 
this study, although the proposed approach can be applied to time- 
varying soft failures as well. 

In the development of the FDI logic, it is assumed that only one of 
the sensors or actuators will fail at a time. Multiple sequential and 
multiple simultaneous failures are not addressed in this paper. The 
likelihood of multiple simultaneous failures is considered to be very 
low. To handle multiple sequential failures, a hierarchical fault 
isolation structure, as demonstrated by Menke et al. [7], must be added 
to the proposed FDI logic. In the following sections, the approach for 
sensor and actuator FDI in conjunction with component fault detection 
is discussed. 


Component Performance Analysis 

Engine component performance is represented by a set of so-called 
health parameters. The health parameters deviate from initial healthy 
baseline values as the components degrade; therefore they are an 
indicator of the engine internal condition. A linear engine model 
under consideration is represented by the following state-space 
equations: 

x = Ax + Lh + Bu cmd 
y - Cx + Mh + Du cmd +v 

where the vectors x, h, u cmd represent state variables, health 
parameters, and control variables, respectively. The sensor 
measurement vector, y, is corrupted by the sensor noise vector, v. The 
matrices A, B , C, D , L, and M have appropriate dimensions. The 
influence of health parameters on an engine is similar to that of the 
control variables, however, the health parameters are not measurable 
and are thus treated as a part of the augmented state to be estimated. 
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In the Kalman filter problem setup, the engine state vector is 
augmented with health parameters as follows [8]: 


x = Ax + Bu cmd + w 
y = Cx + Du cmd +v 


( 2 ) 


where 


X 


~A 

L 


~B~ 

h 

, A = 

0 

0 

, B = 

0 


c = [c 


m] 


and w and v are the process and sensor noise, respectively. They are 
uncorrelated, white noise with the following covariance matrices: 


E w(t + t)w t (/)]= Q8{t) 
E v(t + t)v t (7)] = RS(t) 


(3) 


The Kalman filter has the following structure: 


= Ax e + Bu cmd + K(y - y e ) 

y e — Du cmd 



y Wand 

Figure 2. Structure of Bank of Kalman Filters 

From this residual, a weighted sum of squared residual (WSSR) is 
computed: 

WSSR 1 = W r ‘ (e l ) r (V ) _1 e l (6) 


where x e and y e are the estimates of augmented state vector and 

sensor measurements, respectively, and K is a Kalman gain matrix. In 
general, the matrix R is derived from available sensor noise 
characteristic data while the matrix Q is tuned for obtaining a desired 
Kalman gain. In order for the Kalman filter to converge, the matrix 

pair ( A, C ) must be observable. Moreover, the current problem setup 
requires the number of health parameters in the augmented state vector 
to be less than or equal to the number of sensor measurements [9]. 
The above state-augmented approach is used for designing a bank of 
Kalman filters. 


Sensor Fault Detection 

The bank of Kalman filters for sensor fault detection and isolation, 
shown in Fig. 2, contains m Kalman filters where m is the number of 
sensors being monitored. Each filter estimates the augmented state 
vector discussed in the previous section using (m- 1) sensors. The 
sensor which is not used by a particular filter is the one being 
monitored by that filter for fault detection. For instance, the z th filter 
uses the sensor subset / that excludes the z th sensor, where z is an 
integer from 1 to m. In the event that sensor #z is faulty, all filters will 
use a corrupted measurement, except for filter #z. Consequently, filter 
#z is able to estimate the augmented state vector from fault-free sensor 
measurements, whereas the estimates of the remaining filters are 
distorted by the fault in sensor #z. 

After the estimation of augmented state variables, the sensor 
measurement estimates are constructed as described in Eq. (4). In 
order to evaluate the accuracy of the state estimation, the following 
residual vector is generated for each filter: 

(5) 


where 

I' =diag[a‘] 2 

The vector d represents the standard deviations of the i th sensor- 
subset, and it normalizes the residual vector. The additional weight W r 
is a scalar, and it is selected so that the value of the WSSR signal will 
be less than a given threshold under the normal condition where all 
sensors are fault free. The scalar W r is a tuning parameter that 
influences the FDI performance. If the weight W r is too small, the 
increase in WSSR due to a faulty sensor will not be observed, causing 
missed detections. On the other hand, if this scalar is too large, the 
WSSR signal will be too sensitive to sensor noise and modeling 
uncertainty and may generate false alarms. The fault indicator signal 
(i.e., WSSR) in Eq. (6) will be compared against the detection 
threshold in order to detect a sensor fault. 


Actuator Fault Detection 

Actuator FDI is more challenging than sensor FDI in model-based 
estimation approaches. In the general Kalman filter approach, it is 
assumed that the actuators are properly configured to the positions that 
a control system demands, thus any engine responses to actuator 
perturbations are cancelled out in the estimation loop. However, if a 
large discrepancy between commanded and true actuator positions 
does exist due to an actuator fault, it can result in significant state 
estimation errors. In this paper, an actuator fault is modeled as a bias, 
which results in an inconsistency between an actuator command used 
as a Kalman filter input and a true actuator position under which the 
engine is operating. 

To account for a potential bias, the following linear engine model is 
used in the actuator FDI design approach: 
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x = Ax + Lh + B(u cmd + b) 
y — Cx + Mh + D(u cmd + Z?) + v 


(9) 


(7) 


Equation (7) shows the actuator bias vector b added to the actuator 
command inputs. 

A bank of Kalman filters is also applied for the actuator FDI though 
its structure will be different from that of the sensor FDI. Unlike the 
sensor FDI approach where each filter excludes one sensor from the 
sensor suite, each filter in the actuator FDI will use all m sensors and 
estimate an augmented state vector, which includes an actuator bias. 
Similar to the sensor FDI approach, the engine state variables in Eq. 
(1) are augmented with the health parameters and, in addition, one 
actuator bias. For the bias estimation of the k th actuator, the following 
model equation is used: 


x k = A k x k + Bu 


cmd 


+ W 


y k - C k x k + Du cmd + v 


( 8 ) 


where 


X 

h 

II 

1 

1 

-is; 

1 



A 

L 

B k ~ 


~B~ 

0 

0 

0 

,B = 

0 

0 

0 

0 


0 


,C k =[C M D k \ 


and k is an integer from 1 to p , where p is the number of actuators. 
The scalar b k is a bias in the k th actuator, and the vectors B k and D k are 
the k th columns of B and D matrices, respectively. Based on the above 
state-space structure, a Kalman filter for each actuator is designed 
using Eqs. (3) and (4). 

After the estimation of the augmented state variables and sensor 
measurements, a fault indicator signal is generated for each filter 
similar to the sensor FDI approach. The residual signal of the ( m+k) ih 
filter is given as: 


e m+k =y k e -y 


where the vector y k is the sensor estimates generated by the ( m+kf h 
filter. From this signal, the following weighted sum of squared 
residual (WSSR) is generated: 


WSSR m+k = V k (e m+k ) T (rr 1 e m+k 


( 10 ) 


where 


£ = diag[cr ] 2 


The vector cr is the noise standard deviation, and the scalar V r is a 
weighting factor for the FDI performance trade off. The fault 
indicator signal (WSSR) in Eq. (10) will be compared against a given 
detection threshold in order to detect an actuator fault. When an 
actuator is biased, all filters use corrupted information, however, the 
one filter with the correct hypothesis is able to accommodate it. 
Therefore, this particular filter will maintain a low residual value and 
consequently can be isolated from the rest of the filters. 


Integration of Bank of Kalman Filters with Fault Isolation 
Logic 

The overall architecture of the FDI system is shown in Fig. 3. The 
functionality of the bank of Kalman filters with an augmented state 
vector is summarized as follows. 

1) When there is no sensor or actuator fault, with or without 
component faults, all Kalman filters should retain low fault 
indicator signals, indicating there is no sensor/actuator fault, 
and should generate accurate health parameter estimates. 

2) When one of the sensors or actuators failed, with or without 
component faults, only the one filter with the correct 
hypothesis should generate a low fault indicator signal and 
accurate health parameter estimates. 



Figure 3. FDI System Architecture 
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The fault indicator signals generated by the above approach must be 
further processed in order to identify a fault. The FDI process can be 
completed by integrating the bank of Kalman filters with fault 
isolation logic as shown in Fig. 3. In general, fault isolation logic is 
constructed from detection thresholds and decision rules. The decision 
rules check for fault indicator signal violation of the pre-established 
detection thresholds. If the necessary rules for the existence of a fault 
are satisfied, then the fault isolation logic declares a fault. Fault 
isolation is achieved if a fault is declared for all the fault indicator 
signals except for the one corresponding to a correct fault hypothesis. 
The development of fault isolation logic is application-dependent. An 
example will be given in the following section where the FDI design 
methodology is applied to an aircraft engine model. 


Table 2. Sensor Noise Standard Deviation in % of the 
N ominal Engine Trim Valu es 


Sensor 

a 

XN2 

0.25 

XN25 

0.25 

T27D 

0.50 

T56 

0.50 

PS15 

0.50 

P27 

0.50 

PS3 

0.50 

PS56 

0.50 


APPLICATION OF FDI METHODOLOGY TO AN AIRCRAFT 
ENGINE 

In this section, the FDI design methodology is applied to an aircraft 
engine model. A description of the engine model will be given, 
followed by a description of the fault isolation logic development. 


Engine Model 

The engine model used in the current research is the nonlinear 
simulation of an advanced military twin-spool turbofan engine [10]. 
This simulation is constructed as a Component Level Model (CLM), 
which assembles the major components of an aircraft engine. Engine 
performance deterioration is modeled by adjustments to efficiency 
and/or flow coefficient scalars of the following five components: Fan 
(FAN), Booster (BST), High-Pressure Compressor (HPC), High- 
Pressure Turbine (HPT), and Low-Pressure Turbine (LPT). These 
scalars representing the component performance deterioration are 
referred to as health parameters. The actuator dynamics are much 
faster than the engine dynamics. The engine state variables, health 
parameters, actuation variables, and sensor measurements used in the 
current research are shown in Table 1. 


Table 1. State, Health, Actuator, and Sensor Variables 


State Variables 

XNL, XNH, TMPC 

Health 

Parameters 

FAN efficiency, FAN flow capacity 
BST efficiency, BST flow capacity 
HPC efficiency, HPC flow capacity 
HPT efficiency, HPT flow capacity 
LPT efficiency, LPT flow capacity 

Actuators 

WF36, A8, A16 

Sensors 

XN2, XN25, T27D, T56, PS15, P27, PS3, 
PS56 


In this paper, the standard deviations of the sensor noise shown in 
Table 2 are used. These numbers are rough estimates derived from Lu 
et al. [11]. Information regarding sensor accuracy can be also found in 
Pinelli et al. [12]. 

An assumption is made in this application problem. It is assumed 
that the first four health parameters (FAN and BST efficiency and flow 
capacity scalars) in Table 1 are sufficient to represent component 
faults of interest during a flight. The health parameters represent 
engine internal condition. These parameters deviate from initial 
healthy baseline values over time due to gradual degradation (aging 
phenomenon) and possibly abrupt degradation (fault). The focus of 
the current research is the detection of faults rather than the trending of 


component performance deterioration due to aging. The four health 
parameters are used to represent an abrupt, moderate degradation due 
to foreign object damage (FOD), as done by Kerr et al. [13]. The 
detection of such component faults is achieved by accurately 
estimating those selected health parameters. Therefore, they are 
included in the augmented state vector and estimated as described by 
Eqs. (2) through (4). The selection of the four health parameters was 
based upon their correlation to FOD events and the relative likelihood 
of an engine experiencing FOD versus other possible abrupt 
component degradations during a flight. If alternative faults are 
known to be more probable, the FDI system can be re-designed using 
those health parameters which correlate to the faults of interest. The 
design constraint is that the selected health parameters must be 
observable through the given sensor suite. 


Development of Fault Isolation Logic 

In order to isolate a fault using the bank of Kalman filters developed 
in the previous sections, fault isolation logic must be developed. This 
decision-making logic is discussed in this section in the context of a 
simulated example. Consider an example in which the fault indicator 
signal generation process in Fig. 3 is applied to the nonlinear engine 
simulation for a scenario where all the sensors and actuators remain 
fault free. Figure 4 shows the fault indicator signals (WSSR) for the 
selected FDI filters; these signals have been filtered through a low- 
pass filter with a cutoff frequency of 1.0 rad/sec. The noise in the 
sensor measurements is quite significant and causes large variations in 
the health parameter estimates and the fault indicator signals. 


DC 

C/D 

C/D 


DC 

C/D 

C/D 


£ 






Figure 4. Fault Indicator Signals of Select FDI Filters 
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Two factors that are of main concern in developing the fault 
isolation logic are false alarms and missed detections. Reducing one 
of these factors often causes an increase in the other. To illustrate how 
the isolation logic affects false alarms and missed detections, assume 
that, in the current case, a fault is declared for an FDI filter when the 
corresponding fault indicator signal exceeds a given detection 
threshold. If the detection threshold is set at the value of one, all of the 
fault indicator signals in Fig. 4 exceed the detection threshold; 
therefore multiple false alarms would have occurred. To avoid such 
false alarms, two options are possible: 1) increase the detection 
threshold value, or 2) smooth the fault indicator signals by modifying 
the bandwidth of the low-pass filter. Both options, however, may 
cause missed detections. A fault may result in a shift in the mean 
value of some fault indicator signals without any spike-like responses. 
In such a case, a failure scenario will go undetected until the 
magnitude of the fault becomes severe enough to reach the higher 
threshold. Also, reducing the bandwidth of the low-pass filter will 
eliminate any spike-like fault signatures in the fault indicator signals, 
making such failures more difficult to detect. 

In the current study, a modified approach for fault isolation is 
developed in order to reduce false alarms and missed detections as 
much as possible. First of all, the fault indicator signals of all 11 
Kalman filters are averaged over non-overlapping, ten-second 
intervals. For sensor FDI filters, two thresholds are used: the first 
threshold is set at the value of one, and the second is set at the value of 
two. A fault is declared if the ten-second averaged fault indicator 
signal exceeds the first threshold three consecutive times, or if the 
non-averaged fault signal exceeds the second threshold. The first rule 
(using the averaged signal) addresses a mean value shift of the fault 
indicator signal that is sustained. This rule results in a minimum fault 
identification time of 30 seconds. The second rule (using the non- 
averaged signal) obviously takes into account spike-like fault 
signatures. The second threshold is set high enough so that sensor 
noise or modeling uncertainty will not cause the fault indicator signal 
to exceed it. 

For actuator FDI filters, only one threshold, set at the value of one, 
is used. A fault is declared if the ten-second averaged fault indicator 


signal exceeds the threshold four consecutive times. The reason for 
applying a different rule for actuator failures is as follows. For 
actuator FDI, the response of the “correct’ ’ Kalman filter is influenced 
by an actuator bias, whereas a sensor bias does not influence the 
response of the “correct” filter for sensor FDI. When an actuator is 
biased, the actuator position estimated by the “correct” Kalman filter 
initially follows the control command, indicating that there is no bias. 
After going through this initial error phase, the estimated position 
starts converging to the true actuator position. This initial estimation 
error can be huge depending on the bias magnitude. Therefore, spike- 
like signatures, which could be generated by both “correct” and 
“wrong” filters, cannot be used as an actuator fault indicator. 
Moreover, the initial estimation error transient of the “correct” Kalman 
filter may result in high residuals which persist for longer periods than 
in the sensor FDI case. To account for this fact, the detection 
threshold must be violated four consecutive times before declaring a 
fault, instead of three times as for the sensor FDI. 

Fault isolation is successfully achieved when the fault isolation 
logic detects a fault in all filters except for the one “correct” filter. If a 
“wrong” filter is isolated, it is considered a false alarm. If the isolation 
logic detects a fault in at least one filter, but multiple filters indicate 
no-fault, it means that a fault was detected but not isolated. FDI 
performance depends on the decision rules and the values of the 
detection thresholds. They are adjusted by the designer in order to 
meet the desired system performance requirements. 


PERFORMANCE EVALUATION OF THE FDI SYSTEM 

The performance of the FDI system is evaluated in this section by 
applying it to the nonlinear engine simulation trimmed at a cruise 
operating point. The FDI performance is evaluated based on the 
minimum sensor/actuator bias magnitude which can be isolated, and 
the accuracy of health parameter estimates. Multiple scenarios are 
considered to ensure that the FDI system does not identify any 
component faults as a sensor or actuator fault. To capture a range of 
expected component faults, the eight scenarios, shown in Table 3 with 
health parameter and control command perturbation magnitude and 


Table 3. Engine Operation Scenarios for Evaluation of the FDI System 


Scenario 

# 

Perturbation Description (magnitude and step time) 

FAN 

efficiency 

FAN 

flow 

BST 

efficiency 

BST 

flow 

WF36 

A8 

A16 

1 

0 

0 

0 

0 

0 

0 

0 

2 

0 

0 

0 

0 

2% 

at 5 sec 

-1% 

at 8 sec 

-3% 
at 7 sec 

3 

-1% 

at 5 sec 

-1% 

at 6 sec 

-1% 

at 10 sec 

-1% 

at 12 sec 

0 

0 

0 

4 

-1% 

at 5 sec 

-1% 

at 6 sec 

-1% 

at 10 sec 

-1% 

at 12 sec 

2% 

at 20 sec 

-1% 

at 23 sec 

-3% 

at 22 sec 

5 

-2% 
at 5 sec 

-2% 
at 6 sec 

-2% 

at 10 sec 

-2% 

at 12 sec 

0 

0 

0 

6 

-2% 
at 5 sec 

-2% 
at 6 sec 

-2% 

at 10 sec 

-2% 

at 12 sec 

2% 

at 20 sec 

-1% 

at 23 sec 

-3% 

at 22 sec 

7 

-3% 
at 5 sec 

-3% 
at 6 sec 

-3% 

at 10 sec 

-3% 

at 12 sec 

0 

0 

0 

8 

-3% 
at 5 sec 

-3% 
at 6 sec 

-3% 

at 10 sec 

-3% 

at 12 sec 

2% 

at 20 sec 

-1% 

at 23 sec 

-3% 

at 22 sec 
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injection time information, are investigated. In the simulation, these 
perturbations are injected as step changes at the specified time. The 
perturbations in the four health parameters represent abrupt component 
degradation due to a FOD event. Since field data indicating actual 
component degradation profiles due to FOD was not available, the 
magnitudes and injection times were selected arbitrarily. Likewise, 
control command perturbations were selected arbitrarily to represent 
operation around the fixed operating point. As shown in Table 3, 
multiple health parameters are perturbed in order to introduce the 
nonlinear effects on the engine simulation outputs. The control 
command perturbations disturb the engine operating point; however, 
they must not cause a false alarm. 


Robustness Issues of the FDI System Toward Engine 
Uncertainty Due to Aging 

In the real engine environment, a mismatch in the health condition 
between an operational (aging) engine and the “nominal” engine 
model used by the FDI system almost always exists. It is well known 
that the physical engine components deteriorate gradually due to wear 
and tear on blades and casing as an engine operates over time [14]. In 
this paper, such gradual component deterioration is referred to as 
“baseline degradation” and is represented by deviations in all 10 health 
parameters. Two baseline conditions used for FDI performance 
evaluation are shown in Table 4. The FDI system is applied to the 
nonlinear simulation at these two baseline conditions for each of the 
eight scenarios in Table 3. The current FDI design does not account 
for the changes in the baseline condition, i.e., the bank of Kalman 
filters is designed based on the healthy engine baseline. Therefore, if 
the FDI system is applied to the nonlinear engine simulation at 
baseline condition #2, the baseline mismatch will impact the FDI 
performance. It should be noted that the abrupt health parameter 
perturbations in Table 3 are deviations from the baseline conditions in 
Table 4. Therefore, a 3% reduction in FAN flow capacity (Scenarios 7 
and 8) for engine baseline #2 (Table 4) means 5.2% degradation in 
total. 


Table 4. Baseline Degradations in % from the Nominal 
Baseline Condition 



Baseline 1: 
Nominal (Healthy) 

Baseline 2: 
Degraded 

FAN efficiency 

0 

-1.80 

FAN flow 

0 

-2.20 

BST efficiency 

0 

-2.00 

BST flow 

0 

-2.20 

HPC efficiency 

0 

-1.50 

HPC flow 

0 

-1.20 

HPT efficiency 

0 

-2.00 

HPT flow 

0 

1.50 

LPT efficiency 

0 

-1.20 

LPT flow 

0 

2.00 


The effects of baseline mismatch on the FDI performance are shown 
in Table 5 where the FDI system was applied to the nonlinear 
simulation at the two baseline conditions. The simulation was run 
without any health parameter or control perturbations (Scenario 1) and 
without any sensor or actuator faults. 

Table 5 shows the estimation performance of the FDI filter #1 
which is designed to monitor the XN2 sensor. All estimation values 


were averaged over 100 seconds. Note that this FDI filter constructs 
the sensor bias estimate from the estimated state variables. As 
expected, the deviations in all 10 health parameters (baseline 
degradation) for condition #2 are incorrectly attributed, or “smeared,” 
to the four health parameters being estimated, resulting in 
unacceptable health estimation. A similar result was observed in real 
engine testing conducted by Luppold et al. [15]. Moreover, the overall 
sensor/actuator FDI performance appeared to vary with the baseline 
condition: none of the FDI filters declared a fault for the baseline 
condition #1, whereas all 11 FDI filters declared a fault for the 
baseline condition #2. This example demonstrates the sensitivity of 
the FDI system, which is designed based on a healthy engine, to the 
baseline degradation of aging engines. 


Table 5. Estimation Performance of the FDI Filter #1, XN2 
(Simulat ion Scenario 1 without Sensor or Actuator Fault) 



Average Estimation of Filter #1 (XN2) 

Nonlinear 

Sensor 

FAN 

FAN 

BST 

BST 

Baseline 

Bias 

Efficiency 

Flow 

Efficiency 

Flow 

Condition 

(% of trim) 

(%) 

(%) 

(%) 

(%) 

1 

-0.03 

-0.05 

-0.11 

0.09 

0.05 

2 

-3.95 

-11.45 

-13.98 

1.37 

6.13 


The loss of FDI performance due to aging effects can be partially 
recovered by modifying any of the following three parts of the FDI 
system shown in Fig. 7: 1) Trim Value Data, 2) Bank of Kalman 
Filters, and 3) Fault Isolation Logic. 



Figure 7. Structure of the FDI System 


The trim value data contains sensor and actuator steady-state values 
at a trim condition where the bank of Kalman filters is designed. As 
the baseline degradation worsens, the difference in the steady-state 
values at the trim point between the degraded and healthy engines 
increases, causing a loss of FDI performance. If the trim value data is 
updated to account for baseline degradation, the initial steady- state 
estimation errors can be eliminated. Since the baseline degradation 
progresses gradually, such a trim value update can be performed after 
a number of flights through off-line trend monitoring as done by 
Kobayashi et al. [16] and Volponi [17]. In this approach, a mismatch 
between the dynamics of the operational engine and the nominal 
model used by the FDI system may still exist. A more involved option 
for reducing the estimation error is to update the bank of Kalman 
filters based on the baseline degradation. After updating the trim 
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value data, a linear model can be generated at the corresponding trim 
condition. By designing a bank of Kalman filters based on this linear 
model, both the initial steady-state condition and the dynamics of the 
FDI system will match with those of the operational engine. The ease 
with which such linear model generation can be achieved is key for 
making this approach practical. Another option for regaining the lost 
FDI performance is to modify the fault isolation logic. The difference 
in the initial steady-state values between the operational engine and 
the nominal trim value data causes an increase in the steady- state 
values of the fault indicator signals. By simply setting the threshold at 
a higher value, a false alarm can be avoided. However, this approach 
results in conservative performance when the operational engine is 
healthy. Among the three options discussed above, the first option 
(updating the trim value data) is the simplest approach. This option 
will be evaluated in the following section. 


Evaluation Results 

In this section, the performance of the FDI system is evaluated by 
applying it to the nonlinear simulation for the eight scenarios in Table 
3. For each scenario, the nonlinear simulation is executed for 100 
seconds at the two baseline conditions shown in Table 4. When the 
FDI system is applied to the nonlinear simulation at baseline condition 
#2, the trim value data is updated, assuming an updating technique is 
available, so that the initial steady-state mismatch is eliminated. 

A sensor or actuator bias is injected as a step change when the 
simulation time reaches 30 seconds. As previously mentioned, the 
FDI performance is evaluated based on the minimum sensor/actuator 
bias magnitude which can be isolated, and the accuracy of health 
parameter estimates. The smaller the minimum bias that can be 
isolated, the better the performance of the FDI system is considered to 
be. However, if the minimum bias becomes too small relative to 
sensor noise, the assumption that one sensor or actuator may be biased 
at a time may no longer hold since multiple sensors and actuators may 
contain small biases in the real engine environment. Therefore, it is 
undesirable to have an FDI system which is overly sensitive to small 
sensor or actuator bias. For health parameter estimation, the 


performance is considered acceptable if the average estimation error 
(difference) is less than 0.5%. 


1) Nominal Performance: Baseline Condition #1 . Table 6 
shows performance evaluation results when the FDI system is applied 
to the nonlinear simulation at baseline condition #1. For each of the 
eight simulation scenarios, a bias was injected into one of the sensors 
or actuators, and then the bias with the smallest magnitude that could 
be isolated by the FDI system was determined. The isolated minimum 
positive bias shown in the table is in % of trim value of the nominal 
baseline condition. It is desirable to normalize the bias by full-scale 
values in addition to trim values. However, full-scale values for this 
engine model are currently not available. The numbers in parentheses 
indicate the Euclidian distance (square root of sum of squares) of four 
health parameter estimation errors, each of which was averaged over 
the last 50 seconds of the simulation. The entries that correspond to 
cases where at least one health parameter estimation absolute error 
was larger than or equal to 0.5% are shaded. It should be noted that 
the health parameter estimation accuracy of each of the eight sensor 
FDI filters is independent of a bias in the corresponding sensor. No 
false alarms were generated on any simulation scenario with 
sensor/actuator bias (88 cases) or without sensor/actuator bias (8 
scenarios). 

From Table 6, it is observed that the magnitude of the minimum 
isolated bias for individual sensors and actuators varies slightly with 
the simulation scenario. However, apparent variations in bias 
magnitude can be observed between different sensors and actuators. 
For instance, the bias in the XN25 sensor can be isolated at low 
magnitude while the minimum bias that can be isolated in the A16 
actuator is quite large. The performance variations among the FDI 
filters are considered to be mainly due to the uniqueness of the 
information provided by the sensors and actuators. During the course 
of the performance evaluation, it was found that the following pairs of 
FDI filters were difficult to isolate from each other: T56 and WF36, 
PS 15 and A16, and PS56 and A8. Particularly, in the cases where 
either PS15 or A16 is biased, the two FDI filters focused on these 


Table 6. Performance of the FDI System Applied to Nonlinear Simulation at Baseline Condition #1 


Simulation 
Scenario # 

Isolated Minimum Positive Bias in % of Nominal Trim Value 
(Euclidian distance of health parameter estimation errors in parentheses) 

XN2 

XN25 

T27D 

T56 

PS15 

P27 

PS3 

PS56 

WF36 

A8 

A16 

1 

3.3 

(0.11) 

0.9 

(0.01) 

1.4 

(0.03) 

2.8 

(0.03) 

12.1 

(0.07) 

3.2 

(0.01) 

1.4 

(0.01) 

4.8 

(0.05) 

2.6 

(0.01) 

5.6 

(0.06) 

25.1 

(0.02) 

2 

3.3 

(0.23) 

1.1 

(0.19) 

1.3 

(0.17) 

2.4 

(0.19) 

12.1 

(0.20) 

3.9 

(0.23) 

1.5 

(0.16) 

4.7 

(0.21) 

3.2 

(0.19) 

6.0 

(0.19) 

32.3 

(0.18) 

3 

3.6 

(0.27) 

1.1 

(0.32) 

1.3 

(0.34) 

2.6 

(0.33) 

10.2 

(0.34) 

3.5 

(0.32) 

1.5 

(0.36) 

4.2 

(0.35) 

3.1 

(0.34) 

5.5 

(0.34) 

34.9 

(0.33) 

4 

3.5 

(0.35) 

1.3 

(0.21) 

1.3 

(0.21) 

2.9 

(0.22) 

9.7 

(0.21) 

3.7 

(0.22) 

1.3 

(0.23) 

3.5 

(0.25) 

3.1 

(0.19) 

5.3 

(0.26) 

32.8 

(0.18) 

5 

2.8 

(0.49) 

P O 
& vo 

1.2 

(0.59) 

2.1 

(0.59) 

9.7 

(0.58) 

3.9 

(0.60) 

1.3 

(0.58) 

3.5 

(0.57) 

2.4 

(0.60) 

5.8 

(0.62) 

25.1 

(0.59) 

6 

2.8 

(0.70) 

0.9 

(0.47) 

1.1 

(0.47) 

2.1 

(0.48) 

10.1 

(0.47) 

3.8 

(0.53) 

1.3 

(0.46) 

3.5 

(0.46) 

2.7 

(0.46) 

5.7 

(0.50) 

25.6 

(0.47) 

7 

3.4 

(0.76) 

1.1 

(0.77) 

1.4 

(0.78) 

2.6 

(0.78) 

11.9 

(0.76) 

3.1 

(0.82) 

1.4 

(0.79) 

4.2 

(0.80) 

2.9 

(0.80) 

5.9 

(0.86) 

30.1 

(0.77) 

8 

3.3 

(0.86) 

1.1 

(0.66) 

1.3 

(0.65) 

2.6 

(0.66) 

11.8 

(0.65) 

3.1 

(0.77) 

1.4 

(0.66) 

4.2 

(0.68) 

3.0 

(0.68) 

5.9 

(0.71) 

30.4 

(0.65) 
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parameters retain low fault indicator signals until the bias magnitude 
becomes very large (see Table 6). A possible approach to handle such 
a problem is to utilize additional information, besides the sensor 
estimation error, in the fault decision making process. Although two 
filters generate small sensor estimation errors, it was found that the 
“wrong” filter usually generates health parameter estimates that are 
beyond the expected linear range. For instance, in scenario #1, all FDI 
filters except for the PS 15 and A16 filters exceed the detection 
threshold when the bias in PS15 is 1.5%. With this bias magnitude, 
the two filters retain low residuals; however, the A16 filter generates a 
health parameter estimate above 5.0%, which is considered well 
beyond the linear range. By putting some bounds on health parameter 
estimates, any filter which generates estimated values beyond those 
bounds could be penalized when the fault indicator signal is computed. 

The difficulty of accurately estimating health parameters increases 
as the magnitude of the step perturbation in these parameters 
(component fault) increases. For most of the FDI filters, the health 
parameter estimates are acceptable except for scenario 7. Scenario 7 
can be considered a borderline case where the estimation performance 
of the FDI filters starts to deviate from the acceptable level. FDI filter 
#1 (XN2) generates at least one health parameter estimation absolute 
error above 0.5% in scenarios 6 and 8. The low-spool speed provides 
essential information for estimating health parameters; therefore the 
cases where the XN2 sensor is biased are very challenging in terms of 
obtaining accurate estimation of health parameters. 

2) FDI Performance Recovery: Baseline Condition #2 . 

Table 7 shows performance evaluation results when the FDI system is 
applied to the nonlinear simulation at baseline condition #2. As 
discussed earlier, the trim value data is updated based on the new 
baseline condition so that the initial steady-state mismatch is 
eliminated. No false alarms were generated on any simulation 
scenario with sensor/actuator bias (88 cases) or without 
sensor/actuator bias (8 scenarios). 

It can be observed that the magnitude of the minimum isolated bias 
is very close to the previous case, indicating that the loss of 


sensor/actuator FDI performance due to mismatch in the baseline 
condition can be recovered by updating the trim value data. However, 
the accuracy of health parameter estimation is not recovered. The 
estimation errors become very large when health parameter step 
perturbations exceed 2% (scenarios 5 through 8). Although the initial 
steady-state values were made to match, the new steady-state values 
after the perturbations do not match because of the difference in the 
dynamics (specifically, steady- state gain) between the nonlinear 
simulation and the FDI system. This difference is causing the health 
parameter estimation errors. As discussed before, when there is a 
mismatch in the steady-state condition, the mismatch is “smeared” to 
the four health parameters being estimated. Thus, the four health 
parameters may no longer represent the actual health parameters. 
Instead, they become “tuning” parameters. A Kalman filter tunes 
these four health parameters so that its sensor estimates will match 
with the outputs of the nonlinear simulation. 

As seen in this example, large health parameter estimation errors do 
not necessarily result in large sensor estimation errors. Therefore, 
determining the confidence in estimated health parameters, which is 
currently based on sensor estimation errors, is always a challenging 
issue in the health estimation problem. With the current FDI design, 
component faults can be inferred from changes in the estimated health 
parameters; however, the corresponding damage level cannot be 
estimated accurately. As mentioned previously, one possible approach 
to improve the estimation accuracy is to update the bank of Kalman 
filters based on the baseline degradation. 


Evaluation Summary 

The FDI system was also evaluated for negative biases in each 
sensor and actuator. The results were very similar to the positive bias 
cases in terms of the minimum magnitude of isolated biases and health 
parameter estimation accuracy. Again, the FDI system successfully 
isolated sensor and actuator faults without generating false alarms for 
all simulation cases. In a total of 368 simulation fault cases (176 cases 
for each bias direction and 16 no-bias cases) investigated in this paper, 
no false alarm was generated. 


Table 7. Performance of the FDI System Applied to Nonlinear Simulation at Baseline Condition #2 


Simulation 
Scenario # 

Isolated Minimum Positive Bias in % of Nominal Trim Value 
(Euclidian distance of health parameter estimation errors in parentheses) 

XN2 

XN25 

T27D 

T56 

PS15 

P27 

PS3 

PS56 

WF36 

A8 

A16 

1 

3.5 

( 0 . 14 ) 

0.8 

( 0 . 01 ) 

1.4 

( 0 . 03 ) 

2.8 

( 0 . 03 ) 

11.6 

( 0 . 07 ) 

3.2 

( 0 . 01 ) 

1.4 

( 0 . 01 ) 

4.8 

( 0 . 05 ) 

2.6 

( 0 . 01 ) 

5.5 

( 0 . 04 ) 

25.1 

( 0 . 02 ) 

2 

3.5 

( 0 . 83 ) 

1.1 

( 0 . 41 ) 

1.4 

( 0 . 43 ) 

2.5 

( 0 . 34 ) 

13.2 

( 0 . 38 ) 

3.7 

( 0 . 37 ) 

1.5 

( 0 . 40 ) 

4.2 

( 0 . 41 ) 

2.9 

( 0 . 45 ) 

6.7 

( 0 . 41 ) 

29.2 

( 0 . 41 ) 

3 

3.1 

( 0 . 55 ) 

0.9 

( 0 . 68 ) 

1.2 

( 0 . 68 ) 

2.2 

( 0 . 68 ) 

11.3 

( 0 . 70 ) 

3.3 

( 0 . 62 ) 

1.5 

( 0 . 72 ) 

4.2 

( 0 . 70 ) 

3.0 

( 0 . 68 ) 

5.8 

( 0 . 69 ) 

32.0 

( 0 . 67 ) 

4 

3.5 

( 0 . 41 ) 

1.0 

( 0 . 60 ) 

1.4 

( 0 . 64 ) 

2.1 

( 0 . 61 ) 

11.4 

( 0 . 60 ) 

3.4 

( 0 . 34 ) 

1.5 

( 0 . 63 ) 

4.2 

( 0 . 63 ) 

3.1 

( 0 . 61 ) 

5.2 

( 0 . 59 ) 

31.4 

( 0 . 59 ) 

5 

3.0 

( 1 . 29 ) 

0.9 

( 1 . 30 ) 

i.i 

( 1 . 30 ) 

2.4 

( 1 . 28 ) 

9.9 

( 1 . 26 ) 

3.6 

( 1 . 19 ) 

1.4 

( 1 . 33 ) 

3.8 

( 1 . 30 ) 

2.6 

( 1 . 34 ) 

4.8 

( 1 . 32 ) 

27.0 

( 1 . 28 ) 

6 

3.1 

( 0 . 44 ) 

1.0 

( 1 - 19 ) 

1.1 

( 1 - 23 ) 

2.2 

( U 9 ) 

9.9 

( U 8 ) 

3.7 

( 0 . 95 ) 

1.4 

( 1 . 22 ) 

3.9 

( 1 - 20 ) 

2.9 

( 1 - 20 ) 

4.8 

( 1 - 19 ) 

26.6 

( 1 . 21 ) 

7 

3.6 

( 2 . 11 ) 

1.0 

( 1 - 89 ) 

1.3 

( 1 . 88 ) 

2.8 

( 1 . 85 ) 

11.3 

( 1 . 87 ) 

3.2 

( 1 . 74 ) 

1.4 

( 1 . 91 ) 

4.6 

( 1 . 88 ) 

3.1 

( 1 - 92 ) 

5.9 

( 1 - 94 ) 

34.3 

( 1 . 84 ) 

8 

3.6 

( 1 . 14 ) 

1.1 

( 1 . 79 ) 

1.4 

( 1 . 82 ) 

2.6 

( 1 . 78 ) 

11.5 

( 1 . 79 ) 

3.1 

( 1 . 54 ) 

1.4 

( 1 . 81 ) 

4.3 

( 1 . 76 ) 

3.0 

( 1 . 81 ) 

6.2 

( 1 . 77 ) 

33.8 

( 1 . 79 ) 
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CONCLUSIONS 

An approach utilizing a bank of Kalman filters with an augmented 
state vector was developed for detection and isolation of sensor and 
actuator faults in conjunction with the detection of component faults. 
This methodology was applied to an aircraft engine simulation and 
demonstrated the capability to successfully detect and isolate sensor 
and actuator bias errors even in the presence of engine component 
faults caused by incidents such as foreign object damage (FOD). An 
approach to maintain the robustness of the fault detection and isolation 
(FDI) system even in the presence of engine baseline degradation was 
presented. This approach was demonstrated through an example 
where the FDI system was applied to the nonlinear engine simulation 
at a degraded baseline condition. Since the bank of Kalman filters was 
designed based on the healthy (nominal) baseline condition, the 
baseline degradation of the engine simulation caused mismatches in 
both the initial steady-state condition and the dynamics. The initial 
steady-state mismatch was eliminated by updating the trim value data. 
In the presence of errors due to mismatched model dynamics, the 
Kalman filters used the four health parameters as “tuners” so that 
sensor estimates matched the outputs of the degraded engine 
simulation. Health parameter estimation errors became large because 
of this “tuning” effect; however, low sensor estimation errors were 
retained, and as a result, no false alarms were generated. 

For further improvement of the FDI system, the process to improve 
the accuracy of health parameter estimation in the presence of engine 
baseline degradation needs to be investigated. In future work, the 
above issue will be considered in addition to extending the FDI 
capability over a wider flight region and applying the FDI design 
methodology to other types of faults. 
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